Report Title:
Identity Theft; Prevention
Description:
Requires businesses that maintain or possess personal information of Hawaii residents to protect against unauthorized access to or use of the information after its disposal by destroying the personal information. (SD2)
|
THE SENATE |
S.B. NO. |
2292 |
|
TWENTY-THIRD LEGISLATURE, 2006 |
S.D. 2 |
|
|
STATE OF HAWAII |
||
|
|
A BILL FOR AN ACT
RELATING TO DESTRUCTION OF PERSONAL INFORMATION RECORDS.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:
SECTION 1. The Hawaii Revised Statutes is amended by adding to title 26 a new chapter to be appropriately designated and to read as follows:
"CHAPTER
DESTRUCTION OF PERSONAL INFORMATION RECORDS
§ -1 Purpose. Business records are a leading source of personal information for identity thieves. Any entity that maintains personal customer information as part of its business operations should establish security procedures to maintain the confidentiality and integrity of that data. A critical element of any security plan is the destruction of records containing personal information when they are being discarded. Throughout the United States, there have been repeated instances of businesses carelessly dumping boxes containing scores of customers' personal information in dumpsters. This chapter seeks to protect the people of Hawaii by making such practices unlawful.
§ -2 Definitions. As used in this chapter:
"Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. Except as provided in section -3(e), the term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.
"Disposal" means the discarding or abandonment of records containing personal information or the sale, donation, discarding, or transfer of any medium, including computer equipment or computer media, containing records of personal information, or other nonpaper media upon which records of personal information are stored, or other equipment for nonpaper storage of information.
"Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(1) Social security number;
(2) Driver's license number or Hawaii identification card number; or
(3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account.
For purposes of this section, "personal information" shall not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.
"Records" means any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.
§ -3 Destruction of personal information records. (a) Any business that conducts business in Hawaii and any business that maintains or otherwise possesses personal information of a resident of Hawaii shall take reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal.
(b) The reasonable measures shall include:
(1) Implementing and monitoring compliance with policies and procedures that require the burning, pulverizing, recycling, or shredding of papers containing personal information so that information cannot be practicably read or reconstructed;
(2) Implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other nonpaper media containing personal information so that the information cannot practicably be read or reconstructed; and
(3) Describing procedures relating to the adequate destruction or proper disposal of personal records as official policy in the writings of the business entity.
(c) A business may satisfy its obligation hereunder by exercising due diligence and entering into a written contract with, and thereafter monitoring compliance by, another party engaged in the business of record destruction to destroy personal information in a manner consistent with this section. Due diligence should ordinarily include one or more of the following:
(1) Reviewing an independent audit of the disposal business's operations or its compliance with this statute or its equivalent;
(2) Obtaining information about the disposal business from several references or other reliable sources and requiring that the disposal business be certified by a recognized trade association or similar third party with a reputation for high standards of quality review; or
(3) Reviewing and evaluating the disposal business's information security policies or procedures, or taking other appropriate measures to determine the competency and integrity of the disposal business.
(d) A disposal business that conducts business in Hawaii or disposes of personal information of residents of Hawaii, shall take reasonable measures to dispose of records containing personal information by implementing and monitoring compliance with policies and procedures that protect against unauthorized access to, or use of, personal information during or after the collection and transportation and disposing of such information.
(e) This chapter shall not apply to any of the following:
(1) Any bank or financial institution that is subject to and in compliance with the privacy and security provision of the federal Gramm Leach Bliley Act, 15 U.S.C. sections 6801 to 6809, as amended.
(2) Any health plan or healthcare provider that is subject to and in compliance with the standards for privacy of individually identifiable health information and the security standards for the protection of electronic health information of the Health Insurance Portability and Accountability Act of 1996.
(3) Any consumer reporting agency that is subject to and in compliance with the Fair Credit Reporting Act, 15 U.S.C. sections 1681 to 1681v.
(f) Any person who violates any provision of this chapter shall be deemed to have engaged in an unfair or deceptive act or practice in the conduct of trade or commerce within the meaning of section 480-2. The attorney general or the director of the office of consumer protection may bring an action based upon unfair or deceptive acts or practices declared unlawful by this section.
(g) In addition to any penalty provided for in subsection (f), any person who violates any provision of this chapter is liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation, or damages not less than $500, whichever is greater. The court, in any action brought under this section, may award reasonable attorneys' fees to the prevailing party."
SECTION 2. This Act shall take effect on January 1, 2007.